Prof. Silvio Micali: A New Scalable and Secure Approach to Byzantine Fault Tolerant Consensus (169)

Transcript

[Music] this episode of epicenter is brought to you by Jax Jax is the user-friendly wallet that works across all your devices and handles both Bitcoin and ether go to jx. and embrace the future of cryptocurrency [Music] wallets hi welcome to the epicenter of the show which talks about the Technologies projects and startups driving decentralization and the global blockchain Revolution my name is Sebastian guo and I'm me Roy today we have an extremely distinguished guest on our

show so we are going to talk to Professor Sylvio mik who is a professor at mit's uh computer science and artificial intelligence laboratory now Professor Miki is a recipient of the godal prize and the touring award two of the biggest Awards in computer science science and I actually came to know of Professor M's work when I was researching zcash uh in the last year so in zcash we have this knowledge of uh zero knowledge proofs or ZK snarks and it turns out that Professor mlli is the co-inventor of the idea itself of zero knowledge proof so he wrote a paper in 1985 the knowledge complexity of interactive proof systems where he know sort of went into the idea

of zero knowledge so but I was surprised pleasantly surprised to discovered this year at the beginning of this year that he has come out with uh a new consensus algorithm and which has the potential to power cryptocurrency like systems and blockchain like systems in the future and he calls this system algorand so we're going to talk to about aloran in this particular interview over the next hour so but before we St start let's perhaps have some words from from the professor himself and Professor tell us how you got to be interested in the field of Bitcoin and cryptocurrency oh thank you mayor um so I somehow I I've been working um in cryptography for a long time then I took

a pause and started working in Game Theory and but I heard about a Bitcoin in the background and so finally I decided to ask well what is bitcoin and once I heard about it I fought for a while and says could you please one more time and so I got a second explanation then I saw wow this is a great idea and uh point one but point two you know can one do better and then that's what I got interested in trying to somehow improve the all all approach and in fact actually at the end I ended out starting with a totally new approach alog together so Bitcoin was my main

motivator and I think actually he has motivated a lot of people so whoever uh Mr Nakamoto he's you know thank you very much so uh so Professor there's this uh there's only one video about algorand on the internet where uh I think uh you're talking at U one of the events uh celebrating Professor viiner bit gerson's work and you're talking about aloran and you mentioned like Bitcoin as like a beautiful beautiful invention that is going to change how Society works so what why do you think this invention is important from a computer science perspective what the Bitcoin wants to do is to

implement share The Ledger and so somehow you know we need to have as a society a way to generate consensus about a few things that are important to us so to think about it that there is a if you have a guarantee that there is you know every 10 minutes a page of a newspaper which you know you know that whatever you're reading the rest of the world is reading and so we record there what is important transactions for example and then another 10 minutes there is another page that everybody somehow agrees upon so what I'm reading you are reading and this somehow essentially common knowledge idea is very very powerful so if you look at the internet as it is and as a

web is a repository of information but the timing of it is not clear it's not clear that um um whatever I I see really is u the same thing that you see and so one needs to put some kind of a Law and Order of the internet and so and and on the web and this they have been so useful right now think how much more useful it going to be if you have also these other um common knowledge aspect to it and time aspect to it and so that there is no question in my mind but that is extremely useful tool to have for a society particularly for a modern and Digital Society and the question is really how do we really bring uh into existence

what is the right way to bring it into existence so in in your paper um so I I I have to say we we're talking about this earlier it's a fascinating paper it's a fascinating idea uh there's a there's a talk um that uh we'll link to in the show notes which in which you explain the the concept of this paper but for someone who doesn't have a mathematical or engineering background it is a daunting thing to look at because um it uh it it it's about well it's quite long and it's it's a lot of mathematical formulas um that you need a high level of technicity to understand

uh so we'll try to make this discussion as and I'm sure we will because you're very good at at explaining things and and and um I'm very articulate but uh in the paper you you start by describing some of the technical limitations of proof of work and some of the requirements in a cryptocurrency cryptocurrency like Bitcoin um so could you take us through some uh of those key points somehow U Bitcoin is predicated on the honest majority of uh the miners that this A specialized group that somehow generate blocks a block being a page of

a Global newspaper that appears every 10 minutes to all of us and um so that in so far um to have a requirement of honesty doesn't bother me at all in fact actually I believe that Honesty exist society would not exist at all if somehow there was not an honest majority out there so that doesn't bother me but what bothers me is the assuming the honest majority of a specialized group of people and namely these miners which essentially is quite orthogonal to us as a users in general originally um in the in the original conception I could be a minor and a user

you could be a minor and a user but then it turns out that know somehow from the structure of the Bitcoin the incentives were such that you know mining or generating blocks meaning meaning deciding being able to print the page of a newspaper that everybody reads every 10 minutes is becoming so computational expensive and actually so expensive in electricity alone because computation is powered by electricity V know you and I are going to lose money despite the rewards that are given by Bitcoin to the producer of the page every 10 minutes if we attempt to do it and so there are right now five mining pools groups of

people who join together to try invest Giant for to print the page and there are now five consortia five five pools and so when you actually ask about of the majority of just out of five pools that is a little bit a lot to ask I have no problem assuming the majority of the users you know in the world or or in anything because there is not a majority of users right there we are ay life is not worth living and life will be very short soety CR but somehow to put you know this extraordinary power deciding what is going to be print in in every page every 10 minutes into the hands of

five groups of people that is to me is not I'm sure it was not whatever Mr nagamoto originally intended so that is a problem not the honesty majority of of society but the honest majority of minors yes another problem is of course this a waste of power and so my understanding is that you know with relatively few users Bitcoin already absorbs you know from the production of this a page every 10 minutes know some much electricity as a small country thisa does not scale and I believe that you know if you really want to have a public Ledger that brings us together and generate common knowledge you know

in business in society as a in all of humanity you know it has to scale um much better and um and the other point that that I that worries me is this Forks because somehow in the design of Bitcoin it happens to be a fork think of it like that you're watching somehow the page of this newspaper appear by 10 minutes and suddenly for the next page there are two contenders or three contenders and so somehow uh that of course it generates some ambiguity in the PO reader because it says you know how do I know now what other page everybody's is reading and

focusing in so I'm uh seeing the same thing that everybody else is seeing and there is a a fork resolution some way in which later on somehow we are going to have another single sequence of pages out there but somehow you had to wait um quite a while for this to to happen very often you you cannot rely on the content of a a one page un until uh say when five more pages have been actually appended and actually if you want to have a probability that is a really small uh that this page is not going to disappear and it's going to remain in our common history you have to

wait not for six more pages to appear but maybe 20 so if you if you think about it 10 minutes a page and yet to have a delay of 20 or six is an hour and and 20 is it's much more so it's 3 hours that is is a little bit of a burden and moreover I believe that you know the notion of ambiguity that that whenever you see something on on a page you cannot rely on it right away because there is this lingering uity psychologically is very disturbing because for the success of all operation and not only for a speed H you actually need to have some very

strong sense that once a page is out there you can rely on it and it's not going to disappear on you and yes if you see it everybody will see it and we can assume that is common knowledge and keep going this all makes sense and objectively I think you know if if you look at the Bitcoin protocol with with a fresh shut of eyes and you can look at these problems say objectively that these are these are issues that perhaps would prevent it from scaling or would make it uh vulnerable to certain types of attacks and and this is what you this is what you lay out here now I'm curious have you tried uh confronting these ideas to people in certain Bitcoin forums for instance no I must say that uh I came uh

to this and know essentially like you know a scientist and an academic so so I I I'm not uh I did not somehow publish in a Bitcoin Forum fora and I did not uh um um I'm not a part of this I just you know I I I just went to the design board and say okay if uh if you don't want to rely on miners if you don't want to concentrate the powers in in five hands if you don't want to have this lingering ambiguity that actually um translates uh into um long time to long wait to to certainly certainty and if you want to reduce the cost of production uh because otherwise you know it really is not

going to scale what do you do and then you know I just uh went on uh on on on my own path I was being slightly factious because I know that I know how these types of um very objective facts somehow get misconstrued by by by certain types of people uh in certain specific forms um but yeah enough of that so you also outlined the properties of a good public distributed Ledger uh take us through what in your opinion are uh good properties for good public distributed Ledger first of all it should be should work in a permission environment so in other words know you should be always

open to new users coming in anytime they want and up being being part of all operation it should be computationally trivial very very fast so it is not going to absorb you know much of our computation power and is very low cost it should have a actually it should have in my opinion every page as soon as it appears it can be relied upon instantly rather than to to wait for long and the the total number of bits sent around should be low and in my opinion then I should have no Forks already said this but also should have a very strong security and that uh because in

my opinion if the Ledger is going to become useful to humanity if the world the society really realize on it and the business in particular as a part of society realize on it you can be sure he going to be attacked and so we we need to have a a stronger model of security to um for having you know The Ledger that we Des serve and want so one of the specialities I think um about aloran is that you actually Define u the stronger notion of security and you and and you define a notion of adversary as well right like so in in all of the cryptographic protocols we always have this notion of adversary

that's either trying to listen on the communications or is trying to break the security of systems and you have your own unique definition of uh what should be considered as an adversary when one designs a uh distributed Ledger Ledger protocol so uh could you walk us through this notion of an adversary of of so first of all adversary is not a notion I'm afraid to say something that everybody knows so is at truism that adversaries are a reality so I said before that I really believe that there is no Society without honest majority so there is ma honesty

but there is also grat to smes and very often we have been a little bit Cavalier when when discussing about the adversary because oh the system is secure because you know an adversary is not profitable to be an adversary I mean very often out there the way there are people who are honest thanks goodness there are also people who are actually want to be malicious and for his own sake and if they want to bring the the system to Halt they may not make a dime but they feel proud you know think about people who spread the viruses you know very often they don't have much to gain at all so I believe that if you really want to have a fundamental infrastructure and if we don't believe that to have a very strong adversarial

model we are not having actually a practical infrastructure and actually is we're going to have a dangerous infrastructure because in some sense we would be better off without it than relying on something that ultimately is not secure at all so in my view here is what I'd like to have an adversary adversaries can able to corrupt anyone he wants whenever he wants instantly perhaps we can actually put a budget of how many you can do and that is a is is an old approach perhaps you cannot corrupt more than a third of the users in the world and actually if you're thinking about a infrastructure that is used by millions and millions and millions and millions of people over the internet you know if you can corrupt 10%

is a miracle this is going to be it takes time to corrupt and then nonetheless say take you can corrupt anybody who wants up to say a certain percentage say 10% 20% 30% if you really want to be very pessimistic and very for very safe and then you want to say now that I corrupted actually I can V do my bean so I mean I really seized your computer now your computer no longer belongs to you but belongs to me the bad guy and I can let you say any message you want and I organize perfectly all the bad people okay because if we prepare and defeat this adversary actually we are going to be safe and if you think it's going to be

something milder we are not going to be safe and trust me that there is a say a currency that the world uses and if somebody can prevent from transacting because nobody has access to his or her own money anyway it will happen so it's not know somehow so a fantasy so that's what I I really believe is um the versary that I have in mind so uh is extremely powerful however is not capable of his computational bounded they canot Forge digital signatures and um and uh the only concession that I'm giving is that that once you know a message is uh sent out to the network propagated virally in the network by

honest person he cannot put the message back into the Border I mean no no more than um a government can put back in the bot a message is very spread by wig Lees so when it's a bit once is out of a bottle it's a bit too late to stop but otherwise can corrupt anybody instant tanous organize them and so on so forth so within the properties of uh good public Ledger you you talk about this notion of true democracy and in in the paper you describe the fact that in in algorand all um participants are treated equal so there's no distinction between Miners and nodes and regular users and and so on and so forth and if

you compare that to to it's quite novel because in in other blockchain systems that's not the case so obviously in Bitcoin it's not the case and if you compare it to some newer um more scalable uh bft proof of stake type systems like say Casper for instance uh there is a there is um Network participants and validators who are offline are in fact penalized and this is so that we we have a a high Network availability right if we if if if minor are penalized for coming off for coming offline uh or validators rather then we can assume that the network would say um available and resilient uh can you explain and then in how in algorand you

you counter this problem uh knowing that all M validators and and nodes are the same and they can come in and out of the network at any time well all right so not everything is easily explainable and uh but uh and so first of all um I think yes I think it's important that that somehow is to be a democratic system because my faith is in the honesty of the majority of people and actually if you want technically speaking then that the majority of the money in uh belongs to honest people and that is is okay which is I believe it is true because after all the money is in our pockets

and um the majority of money is in honest people that seems to be the safest assumption then I don't want to bet on the majority of this particular group of this other specialized group at all and therefore it is important that somehow the computation that is required to a user to be mild enough that you can actually do it without problems or even in a background in your laptop without being being worried so if the participation is very computationally inexpensive in some sense you can say you can leave it on your your laptop the same way that you leave it on or

application running in the background anyway and uh that is very different than running a computational intensive operation and so in some sense one can somehow dismiss the fact that people want to go offline because staying being online and giving this occasional light help to algorand is not going to uh is going to prevent for doing anything else you want to do but um if you want to go one step further algorand can actually somehow tell you in advance when uh you are going to be you are going to be taking some crucial steps when when your intervention is really crucial not just

just passing along messages facilitating the propagation of messages algor messages over the network as I'm saying you know me Sebastian somehow if please be online six months from now from noon to no5 because uh I think you know you're going to boost you know the thing of the system of course that is a a metaphor because aland is a collective protocol is a totally distributed lger nobody's going to tell you you is your time of things but somehow you realize yourself when is crucial that you are going to act and so and I believe that if you are going to tell people say hey if you know in advance in a year that you know one are the 10 minutes that you're really

needed could you please possibly be there and I think people will comply is a is a kind of a different model so think about it differently assume that H to say everybody should vote in elections but very often when you think that the election is a forone conclusion you can say you know better things to do now mind you that being in algorand in an election is quite different because algorand run in the background in a computer in an election I should personally go to the poll and cast my vote but assume now that there is an election you say Sylvio you know what if you show up at this election you are going to decide the next president you bet that I will show up and I believe that most people will so this notion

that you can somehow actually H not only being online because it cost you nothing to be online nobody's going to require any mining or expensive operation but actually I can actually schedule and give you just a very short time Windows when you actually have to show up and make a difference may actually solve the problem does this make any sense I think that's the best I could do in in this context to in terms of explanation definitely it it definitely makes sense let's take a short break to talk about Jack Jax is a multi-coin wallet created by the people at the central now in the past if he had a whole bunch

bunch of cryptocurrencies it was a pain to handle them you either had to leave them on an exchange which was insecure or you had to have all these different wallets which was a hassle fortunately now with Jacks those medieval days of darkness misery and suffering are over Jack supports multiple cryptocurrencies and new ones are being added but it's not just storing cryptocurrencies you can do with Jacks but you can also exchange them directly from with inside the wallet thanks to their shape shift integration and since there's only one seed Jax makes it super easy to back up and sync to the other devices Jax works with Windows Macos Linux Android iOS and

has browser extensions for Firefox and chrome so go to ja.io that's jx. to download the wallet and get started today we'd like to thank Jax for their support of epicenter I think we've been talking about algorand um in multiple questions so let's let's just have have you describe aloran in like a paint a broad brush in in with broad strokes and explain to us what are the key components that you're using to make algorand right so if I want to do it in Broad stroke then I'm going to say is is um is the following what is the problem that we are actually facing here the problem is that there are millions and

millions of people all over the world and we want to say I have in in my mind a page of of a paper that should be written you have a different page of a paper that it should be written so does everybody else so it's a question of consensus of of agreement we want to agree on a page in which everybody is behind that page but you know should be my page your page so we need to have this this agreement and tell you the truth this um problem was actually discussed and invented actually in the 80s so it's over years ago and it's called the bantine agreement and it's a very very strong type of agreement you imagine there is a powerful adversary of the type that I was describing before

and despite this adversary could corrupt and totally control say up to a third of a player you know you are going to have all the good guys are going to uh agree on a single page hey that's wonderful so then uh aren't we done well not really why because these protocols essentially want that everybody talks to everybody else over and over and over again in a sequence of rounds and the question is how many rounds and so the number of rounds has to be one more than the possible number of bad people so think of it that assume that you have a

a medium deployment right so a million users not much and assume that that the ver can corrupt and control 10% of the users which is already a lot okay 10% of a million is 100,000 so yet to talk over and over and over again over 100,000 plus one rounds now that is a lot of talking so even if you take a 10th of a second to implement a round it's going to take 69 days to publish a single page of of a paper that cannot possibly work so and what m Mr Nakamoto did is a totally different um a different approach essentially he did to say hey when to

each P when you image your page of paper you have actually to solve a a very difficult computational reader think about an equation that is uh that is uh defined by H your own page and you have to find the solution to this equation so I work independently on the question on my page you work independently on the of your page all equations are equally hard and they're hard enough so that one person in the world no matter how many people try in every 10 minutes only one person is going to solve his own equation and one who solves it propagates a solution uh to the equation and the page that goes with it

so if you look at it what is Magic and what I really much admire about Bitcoin is this idea that invest agreement we don't need to talk at all because to talking back and forth with a million people can take a long time but what I do I stay in my own room I solve my own equation related to my page and so does everybody else in parallel and separately and then the one who succeeds then communicates the solution and the page that's is looks much better than before the problem is that introduces a long time a long computation because you must make sure the ridle the question you to solve is hard enough that despite everybody's

trying to solve it only one every a minute solve it and the people who don't solve is just wasted work etc etc and then the concentration of power latency and everything else but is a brilliant idea so what does algor do I go back to the message passing bantine agreement protocol but I do two things first I find that by in agreement on steroids which is very very very fast so everybody there are going to be the number of rounds of communication think of it is nine in expectation but nine whether the the users are a million or 100 million or a billion you only have

to talk for expected nine times in a row and moreover everybody who has something to say in around should send a single message not a different messages to different people like like it was the case in the past so you have only one message to say to send and you have to say to send this messages and I expected nine times only wow that's already quite a better and perhaps with a million people it could be almost usable directly as it is but then algorand does something else I want to have really super efficiency so what I'm going to do I take as a protocol

that could possibly work for a million but say not for 10 or or more 10 million or more and says and then now I shrink the participants by a cryptographic process say to simplify computation by a factor of a thousand so rather than having a million people conducting this super efficient protocol now I have a thousand people conducting the super efficient protocol and is so much better so what you do is that you invent a new protocol that's what aloran does provides a new protocol for bantine agreement which has some extraordinary property as it is and further more you don't even run it with the old users but somehow you shrink the number of users

in a guaranteed Fair way to a random subset say of sides a thousand all the all users so even though whatever it was already relatively fast now it becomes a thousand times FAS and and therefore becomes much easier to produce the page uh we want to to have produced that is essentially if I want to summarize in one way in two in two steps of this application is bantine agreement message passing bantin agreement not proof for work bantin agreement on steroids and then shrinking bantine agreement in a guaranteed Fair way to a much smaller subset of users so uh I think that was a brilliant EXP nation and uh just for the

convenience of our future selves let us give names to those two things right like let us give so tell us what the name of this bantine agreement on steroids is and tell us what the name of this method of shrinking from a million to a thousand that is okay well the name of a bantin g on steroids has two names one is the nerdy name and then I call it a BBA star B binary bantine agreement and uh and star well because it's from promoting question I think is really is a is a good B in agreement algorithm but the the Cal name is a fast

and furious bantine agreement because in some sense that's what it is so what are the names Fast and Furious bantin agreement or ba a star if you if you prefer the other that is the the agreement proper the other technique to really shrink instead a million users to say a thousand as has also name and um it's called the cryptographic sortition so first of all uh the name was actually suggested by Morris herig a friend of mine and he a great name let me tell you what stition is stition is actually an ancient in um method to um to decide magistracies in very ancient

republics such Athens Florence Venice and so forth and in some sense those people felt that it was a good idea somehow to fill certain positions at random rather than than um by other any other process and so cryptographic sortition is a way in which you rely on cryptography to guarantee to everybody that the people who are ultim elected have been elected fairly and randomly and in a way that is unambiguous so everybody should what who are the fan people in charge of this page of agreeing on this page everybody should know what who they are and everybody should should

somehow believe that they've been fairly selected and so why this is important because the page essentially is going to be digitally signed by suitable majority of this fan people so if I know the fan people and as I see of of this particular page and if I see that this page ass sign has been digitally signed by sufficiently many of these F people then I'm happy and everybody can rely on it and um so somehow a bit better if there is also secret cryptographic sortition and that is something that know is even more unique to algor in which it is is a a way to select people

in a way that is secret and provable secret so that nobody knows that you've been elected but if you've been selected for participating to the small committee who is in charge of this page you can prove it but nobody knows in advance who is part of this so in some sense what algor does is invest uh by secret cryptographic extion is m is make sure that the people select themselves and is a that's a very weird because how do I select myself if I want to go a if I want to squish down a million people to a thousand assume that I run my own private secret lottery in

which I win with probability one in a thousand so if everybody wins it a probability one in a thousand and there are a million people how many winners there going to be well roughly on average a thousand right because a thousand a thousand is a is a million so the point is that algorand does not ask a million people or 10 million or 100 million to talk in order to select together in a fair way a thousand people because so much talking is really a dog eating his own tail right I want to select the people and that's going to take a while so that then once there are few they can select the page this is is a circular argument I want the people

to select themselves and if they they are selected come back with the answer to give you an analogy perhaps is this I don't know uh I think that is this is a way in which Google hire talented uh people and mathematicians sometimes there is a web page or even some physical bundner somewhere close to uh universities and you say can you solve this mathematical riddle if you can call this number and that's how they recruit and that's is a very smart idea of recruiting Because the everybody millions of people try to solve it but the few of them who actually solve this mathematical call up and they are offer a job after

presumably some additional interviewing think of the alternative even if Google were um were the one who do it so how many people should you hire to interview millions and millions of people who believe believe in good conscious to be talented enough to work at Google so it's going to take forever and it's going to be very expensive process instead here by Magic you say if you solve it on your own time on your own time only if you solve it come back and Report the solution and you are an interviewed right now and essentially by this know secret self- selection algor has extreme efficiency because we don't need to talk

at all about to to generate committee but if you're part of the committee give me proof that you won your own Lottery because your own Lottery is not treatable by you even if it is a you are the only one running it so if you win report and welcome to the committee that essentially is the way um secret cryptographic sortition works okay so is it correct to think that let's say there's there's a newspaper right and each page is um like let's say one block and you know you you have had a lot of them so let's say the newspaper is already like 20 Pages thick and now we need to make the

21st page right so in order to make the 21st page uh and there are like a million users right there are all all the million users they're holding some kind of currency like Bitcoin right like an algor coin or something and now in order to make the 21st page we need to select out of these million uh a thousand and these thousand will be in charge of creating that 21st page so my question is like let's say I am I am one of those million who got lucky and be and uh got selected to be is one of the 1,000 to create that 21st page when do I get to

know that I have the power to participate in the process to create the 21st page okay I right so there are different implementations of aland but say in the basic implementation as soon as the 20th page is published you can determine right away where you are going to help to generate the 21st page yes or no immediately and you do some very simple local computation to you that is going to tell you whether you've been selected or not that is the answer to your question yeah okay now so now now if uh now I'm interested to know like what this puzzle

is that is being used to do cryptographic sortation and the second question is if if my selection as one of the 1,000 in the 20 in the 21st page depends on page number 20 then if I'm an adversary if I if I can manipulate page number 20 then I could also make sure that page number the, people for page number 21 one are also you know corrupt how do how do you prevent that wow May congratulations that is really a heart of a problem and is a main component of a problem and um the way actually you're totally right because if you select the

1,000 people in charge of page 21 from the content of page 20 and uh so somehow could decide what transaction or what to write on page 20 in a way that is going to affect the next page and you have a even minor choices are going to create a very different committees in charge of creating the next page and therefore you select the ones which are most convenient to you so one of the technical contributions of algorand even though is a bit more Technical and not is really to figure out something a different quantity that is part of the page but it's a new quantity and this new

quantity has nothing to do with the transaction is somehow a non manipulatable quantity not influential quantity that somehow guarantees that the the people of the next page are really selected properly and that is um uh really the zest of the matter and uh it cannot be the block itself it cannot be the payments in the block there payments it cannot be the ash of the block it can a lot of things cannnot be but you have to invent this other quantity that somehow is inductively defined so so the quantity of one page someh determines the quantity of the second page but in a way in which you focus on the problem I want to take out

from this quantity all influence from the bad guys and if you face it like this rather than just working with a generic block then you are able to algor solve the problem today's magic word is steroids s t r o i DS head over let's stock bitcoin.com to sign in enter the magic word and claim your part of the listener award so uh so Professor you have uh you you have walked us through this notion of um through this uh fundamental component of uh secret cryptographic stion and your your claim is that 3,000 validators for newspaper page 21 will be

generated from the contents of newspaper page 20 and you've also said that in order to select the thousand of newspaper page 21 all of them only have to look at some data inside page number 20 and they self select themselves but how do you ensure that the the the data on page newspaper page 20 which will determine the selection of the Thousand is true truly random and cannot be controlled by anybody and how does it exactly work in the algorithm well exactly work is on the on in this medium even without a a white board is a little bit much but I

can give you the zest so the idea is remember that we do have here a system in which people for instance have a secret key why because any algorith users or any user right is going to say for is use a secret key say to to make payments so there is a secret digitally sign key okay and more over this a digitally sign key right who knows it only I do know and are my signatures are predictable by others not really right because if we know a billionaire if we can predict a Billionaire's digital signatures how about we can predict please what the S is he owns me a billion dollar right so there is

already intuitively some Randomness which is not the randomness in the block but is some Randomness comes from the secret key that people use because digital signat to be somewhat unpredictable so now if you combine these things to say there is already a source cryptographic source of unpredictability if you manage to distill it and to make it something very very um random and and small like a 20 byte randoms extracted from that then you are better served and if you further constrained so somehow that I cannot shop around with my secret key for many things to sign so that I can pick and choose which random outcome I want from

from being selected but if a system somehow forces me that I can produce a single digital signature that can be verified and then from it there single thing I extract whether I'm winning of of my own Lo or not that that makes the deal so essentially I need to know to to realize if I'm selected only 20 B from the previous page I use my secret key to determine a proof that only I can produce and this proof is a proof that actually belong to the committee of the next page only with probability one in a thousand so you can see that you know everybody can you don't need to select

people among the people that are somehow present in the network right now rather once you see the previous page once you see this 20 by quantity of the previous page I somehow do essentially a digital signature and from it I can prove to myself nothing to do with the next page which most of the time that is the case but the probability one in a thousand I'm actually called to act on on to produce the next page so and only the people who call to act even though they were not visible particularly to other people in the network so somehow they can certainly propagate one digital signature proving that their member of the next p the committee in charge of

the next page and so these these proofs now go in the network and everybody knows who are who is the committee in charge of determing H the next page does this make any sense that actually makes a lot of sense although we couldn't go into the like technical details details because it might be just too complex without whiteboard but I I do get the sense that you are somehow using the randomness embedded inside a private key itself that a private key has to be random in order to be secure you're using that sort of Randomness to create a process that ends up selecting a thousand people out of a million each of these thousand people select each of these thousand

people are self selecting themselves yes so um so now I think we could move move on to the next stage I let so so so cryptographic secret cryptographic sortation is you have Pages 1 to 20 and we have a way to get the committee of thousand people to create page 21 now what happens once we have these th when once these thousand people individually know that they they have the power to somehow influence uh page 21 what do they do and how do they come to consensus oh excellent so remember that now all to so naive what you you should think about doing is the following hey I have a bantine agreement on steroid it almost works

with a million people surely works with just a thousand people and now I see all the other thousand people are because they just gave their proof that they belong like me in the committee so why don't I engage in this bantine agreement on steroid Fast and Furious bantine agreement to select the next page and by the way if you remember V should take rough on a you know nine steps of communication nine rounds of communication that's not so bad why do I say it's naively because remember that I do want to work with a very strong adversary and uh I if I member of this small committee and I send the proof around to the network and the other 999

on average have done the same everybody in the world now knows who are the committee in charge of running the Fast and Furious an agreement to select the next page so what is a bad adversary going to do say a bad adversary who just says you know what I don't want these guys to agree on anything he can just corrupt all of them I mean mind you it's not going to be so easy but maybe he has already corrupted you know 10% of the people one thing is to say that you cannot corrupt 10% of the internet that's okay that's that's a good assumption perhaps but one thing to say can you corrupt you know now the majority of a f people that's a totally different question so to corrupt 10% of

the internet or 20% of the internet may be out of bounds for anybody but to corrupt you know a small committee well maybe it should be possible so the idea there is to have this bantin steroid to have an additional property that is a really a new requirement in protocol design which is a I want to call it player replaceability or generic player protocols I call them before I think player replaceability is really a bit better because what does it mean because because Computing a committee essentially it cost nothing to the network each one selects himself how about if you have a different committee

for each step of the Fast and Furious bantin agreement so there are nine steps n committee no problem where there is however a problem isn't it because what is a protocol even a nstep message protocol is a discussion and can you imagine an intelligent discussion if you take people talk once and then they are killed or corrupted by adversary and take out right and a new set of people come in which had nothing to do with the first and they say something and they are immediately killed and a different set of V some people comes in and you for times what can we accomplish in this conversation they can talk about the

waiver right so so for instance if I'm now replacing in the middle of a conversation which I you know I don't have any shared variables inner variables with the pr people before me I can just say today the weather is good and I get killed somebody else replaces me and out of the BL what can can he or she say says you know let's hope tomorrow is a better day generic discussions we cannot do something as complex to agree on on a page that matters so the idea of algorand is actually to do this bantin agreement that not only is on aage you know somehow nine steps not only the people are self- selected at every single step but they don't need to be the same people they don't need to be the same

number they can really start a fresh from a new set of discussin for nine times in a row and by Magic somehow meaningful progress is made even though the the players who act are totally different players and that is something that you really need if you want to defeat the adversary if you want to have a vanila thing say oh I understand that scaling is good I take you know here is out to do to use generically bantin agreement take a bu agreement even though is not on steroids but know scale it down to very few people you know then it becomes you know almost fast necessary if you if you really scale it down but the what do you people have to consider that if scaling down is a good

idea for efficiency is terrible for security because once you have a small Target the adversary can control all of them and only if you have this you know player replaceability property that you mean that you know the people who need to speak they need to send only one message and then new people will show up in the next round on communication then the adversary if he corrupts me after I sent to the network I'm M or I'm public so and so here is the proof that I'm elected and I'm right to say to talk in step one and here is my message of step one then the adversary say

oh corrupt him I'm out but my message cannot stop remember my message is now virally reach the adversary by is traveling through the network and is reaching everybody else and and whoever is going to be belong to the second committee if even using my generic message you can start say something in step two that cannot be stopped of the adversary because the adversary would like to shoot anybody who speaks who doesn't know a prior who is going to speak because the people secretly select themselves for membership in the commune and the moment in which they announce who they are and say what they had to say is too late for them to corrupt so this player repace ability that is a new requirement that is

Satisfied by this fast and furious of bantine agreement is really what is needed to somehow scale down like crazy agreement because you can safely put in charge a small set of people even though the adversary is plenty capable of attacking somebody anytime he wants as efficient as he want and if in fact actually even a simple denial of service attack you start bombarding with a few committee members by player by by messages is going to prevent them from hearing from each other so I think it is a very important that if you scale down you must have Visa additional property for a bantin

agreement so if I I gave you a partial list of requirements before now I'm going to extend it I want a system that the bantin agreement is permissionless that's computationally fast that has low communication that and that is player replaceable so that if I am in the middle of execution I'm corrupt it doesn't matter the computation correctly keeps on going all all the time that actually to me when I when I hear that it sort of seems impossible because like like the imagination that comes to my head is like like here's there's a big room so imagine you know um imagine it's like

the pope is being elected and there's a thousand Cardinals inside the sine Chapel right that's a good IM and and you know like they have to agree on a pope right so they can they can send a message you know there's like two candidates or something they can write down the candidate name and they can send a message or something and there's going to be nine rounds of communication right so some of the Cardinals are going to speak in round one some of the Cardinals in round two some in round three and some in round nine if you're one of the Cardinals you get to speak only once right you need to send only one message right and once you send that message you can be

corrupted right so it's like 1,000 divided by 9 is what 133 or something some maybe I don't know 111 or something like that right so 111 Cardinals send a message they are corrupted then the next 111 send a message they are corrupted the next 111 send a message then they're corrupted and so on but even with that system the popee gets elected so here is a a step that is part of any actually every bantin agreement ever fought uh since the vention roughly 40 years ago of bantin agreement itself right 35 years ago whatever so an important step is somehow

to take majority right I mean you can imagine that this is very intuitive right so you say h you count how many many people said X say in the in the step before and say if say h 23ds of the people said X right then you you do y else you do something else right there are not the only the only type of instruction in abent an agreement but it is a component of an instruction now think of this assume that even we're not even in the syis trouble where you can actually more or less see each other on the page but the Cardinals because there is this B agreement that work with ADV stay at

home all over the world they talk to one another right in a way that the adversary cannot control so think about this if I see I am somehow um I I'm part of the first batch of cardinal selected and I say x and somebody says Z and so on so forth and then I'm immediately corrupted now you are part of the second batch and the instruction is of the type how many people in the first batch said X do you need to to be me in order to make this determination no why because whoever is in the first bch of cardinals say something and whatever he he or she says propagates for the network and so

he reaches you even boy you not part of the first batch of a cardal so you can make an easy determination of the kind how many people said X even though you are not at all part of of the first batch so the old trick is to define the entire protocol so that only relies on instructions like this instructions that allow for player replaceability I mean that is the essence of the problem is to take um essentially at discussions in which to be player replaceable you can talk about the W you can talk about random things but you can talk about minimally more interesting things such

as determine branch on an instruction if two3 said X do a v overwise do something else right this is also player replaceable so and if all the instruction in this fast and furious protocol that has all the property everybody ever wanted from B agreement also guarantees that the instructions are all of this type then you're done and that's what what system is take what seems a very complex agreement protocol and distill it to something that not only is very fast not only people can self- select but also um is permission as an everything else but also as this other U property of a player

replaceability so that the conversation keeps on going and you get wherever you want to go you reach the right conclusion even though people every time they speak are corrupted so earlier in the in the discussion we talked about forking and and how uh forking um was uh well it is it is a problem in Bitcoin especially in terms of user experience uh when you make a transaction you you you have to assume uh that you're you're waiting for blocks to Comm in um in order for that transaction to be to be safely validated let's take the discussion then sort of The Logical next step into how this player replaceability prevents forking or at least at least makes foring a very very very low probabilistic event great so player

replaceability speaks about the ability of the protocol not to be impeded allows a protocol to go on for nine steps even though the adversary can corrupt or create a denial or service against the to the members of every single step but the all protocol the all bis in agreement right is a probabilistic protocol that allows to get the right decision so because to agree completely on the on the page you really want to say that there has to be a right decision and the prob the probability that the right decision is taken is essentially I'm thinking of it like one minus one over a trillion so the

probability something goes wrong is one in a trillion okay so now one in a trillion well assume that every page is takes 10 minutes and when you expect somehow to have a to have a fork in in the system once every 1 point9 million years roughly speaking one every two million years now with this time scale in some sense you can even forget about Forks because in a time scale of two million years we are to much more worry about the surviving of our species rather than the a fork in our payment networks right I mean that's a that's a

very long time nonetheless should a fork occur algorand does also a fork resolution but what I'm saying is that you don't have to even bother to think about it right because the probability is so low and that is a variable that you can set to whatever you want and I thought setting it uh to one in a trillion H also known as one in 10 to the 12 is low enough by the way there is such a thing at notion that generally used for a catastrophic event such as uh uh we don't want a plane to go down you know probability greater than one in 10 to the 10 but you know say say one in 10 to

the 10 let's make when people worry about their money very often more than their lives let's make it even 10 times lower you know what make it 100 times lower so now we have 10 to minus 12 one in a trillion and if you don't like this wait to see there is a fork over before you rely on your thing right but you know but I think it is a I suspect to be good enough for most people because again you know whatever happens two million years for now there is a fork will deal our ANC our descendant descend we have to worry about it but but in any case there is also Fork resolution process if you really want right okay good that uh that's that's reassuring that there's a fork

resolution process because you know probab probabilistically it could happen next year you know the fork Could Happen uh you know In Our Lifetime found of a probability but yes in principle it's good to have something something Happ so so before we we you we close the show here there's a few other things that we want to talk about uh but uh there there is one topic that um keeps coming up again and again and again and again when talking about blockchains and specifically in the realm of Bitcoin and that is scalability and I'm I'm sure you're at least familiar with the topic of the block size and how that has become a debate that is uh been ongoing for the last oh you know God knows how many years um and and there are multiple

proposals on um how we should address scalability in Bitcoin and what it essentially comes down to uh is uh well should uh Bitcoin be a network that is is sort of allinclusive and allows for a high volume of transactions uh while perhaps um C combing to the risk of being uh centralized or should we preserve uh sort of the ideals of Nakamoto where the network is decentralized but potentially um having really high demand on a network with a limited amount of transactions per block and then therefore perhaps having high transaction fees so you know the those a I'm sort of paraphrasing here making simp simplistic analogies but that's uh

what it kind of comes down to how does aland uh address this is this the is is block size something that is even addressed in aland is it something that you've thought about or perhaps you have some uh some interesting insights for the for the Bitcoin community on how they should handle scaling yeah so essentially here is what what remember there are many competing forces when you want to do a public Ledger and so Bitcoin is a specific public Ledger and um and so somehow has a a certain block size and so on so forth and because also has to avoid Forks not to be too often so everything you know is balanced out algor does things differently right so

think about it so uh if if you want a decentralized system the page that you what before thinking about the sides of the page is how do you distribute the page well if it is the centralized system you have to distribute by gossiping so I send this page to my say eight or 10 of my neighbors they will sell them to random eight of of their friends and so on so forth and and then there is amount of time in which it takes for this page propagated this way to reach every body or 95% of the people on Earth so there are very few hopes but

nonetheless there is some limitation intrinsic latency which is the time for a page to go around the network in a distributed manner to reach everybody well what aloran does he says this limitation is the only limitation because the other limitation the computation is not there to limit anybody to decide that you are part of a committee you do a digital s and only the people who win propagate their signature that's nonsense this is Small Potatoes relative to a block right and so and you do this nine times big deal okay so really ultimately you can bounce the Laten in Alor

coincides essentially with a latency right of of of the intrinsic latency of moving a block until reaches everybody that's all so in some sense better than this algor or nobody else wants to be really decentralized can be because it is the order of this plus Small Potatoes right so more than this you cannot get so therefore you can just say well what the immediate thing is that if our networks becomes faster hey may my so assume they double the speed we can send you know twice as many blocks in algor right away and they can be re relied upon right away rather than in an

hour or at 200 minutes right point one point two is U is is vaa if you want to do algorand on where the validators are actually say a separate entity that's an option is a political option is a is a is a business compromise that you may want to do you may actually have two algorithms right one for the Libertarians and one for the people who accept some our banks or other people to to to do just validation you can choose who is your own validator right and you can share fees if uh he constructs the blocks with you that is all within the

algorand portfolio of options but what is the idea if you subcontract this to a bunch of validators say to 10,000 validators of more Mar but these are actually have a proprietary Network say Bank Network well you know you're not talking about the 10 10 one megabyte per second of it common Fox have now you can have a gigabyte per per second networks and therefore the all thing scales like crazy so to me as a as a the designer of algor my responsibility was to make sure that no Force nothing else impedes the latency of my system and so the latency

of algorand is really coincides with the intrinsic absolutely necessary latency needed to propagate a block plus Epsilon okay that's that's that's the message and then you can actually say if the network improves the thing we can automatically improve because we don't have to avoid that Forks occur too often because Forks has nothing to do you know is largely different than the speed of a network moreover if you want to go on a sub Network which is even faster then the sky is the limit when you can right but more than this in a distributed system to guarantee that there is this lency coincides with intrinsic latency

more than this they cannot do so in in in summary um we have a a consensus mechanism that is being made available to us that is um that relies on trivial computation that is truly demograph uh Democratic in the sense that it it does not distinguish between um miners or validators and nodes um that is scalable that prevents to a very high probability uh forks and also and most importantly I would say eliminates the block size debate um uh what what are

the next steps here because this seems like a very elegant solution uh where are you in the sort of road map of deploying this have you considered you know write is is someone writing this algorithm so that it can be used in blockchain networks well um great question F first of all um I'm so uh let me make it very clear that I'm fully determined to see that this technology is deployed and that actually can be an engine for societal and uh business uh growth and so that is for sure and right now I'm doing further optimization in in the fear of it and a

formal proof not only just um some of basic intuition but the things that are crossing all teas and causing all eyes and then you know with a a wonderful group of very talented colleagues we are actually working on ensuring that there are no technical issues in implementations as a separate from that design and that's all I'm prepared to say at this point in time have you reached out to anybody from the blockchain space or like because there's lots of really smart people that are are not necessarily academics but uh people that are working on things like Casper on tenament pbft um and that are sort of influential within the blockchain space have reached

out to those people so first of all I must say I agree on one thing that uh these are very smart people so I'm not saying I'm not a part of any blog on that way is is a is a generational thing and is much more also perhaps much more my traditional academic style but I'm very impressed uh by the level of ideas and talent and uh you know real intelligence is uniformally distributed and let it be known that it's not the monopolies of universes and think tank and think like this it's amazing how many um smart ideas people have in fact actually is no day goes by that a new smart controls all kinds of a great

application of a ledger um occur so and I think that actually algorand would love to somehow leverage all this you know creativity that it goes on there so it's not only about money it's not about about cryptocurrency it's not about an electronic payment if you want to have a not sell floting currency is really about a public Ledger and essentially this idea that we actually have we endow Society for to have a common trusted party now trusted parties are already rare common is even rarer right because I may have some my 10 people who a trusted party you may have your own

there may be no intersection but think about it suddenly for this lger essentially we share a common trusted party that they can be leveraged in so many ways so they are very smart I agree and there is so much to read and I'm I'm slow in reading and and slow in communicating but will try to to reach uh everybody in the way I know you know conferences talks you know I'm not a blogger that is not me is not is a a generational issue perhaps or is a is of he a little bit who I am am but I certainly I do want a confrontation of ideas and uh and will find to publicize

algorand in in in in in the ways I'm most familiar with right and so I mean this is in fact you know this is probably one really good uh channel to to reach uh that you know to bridge the gaps between you know this this sort of academic community in which you're part of and and this blockchain community if people want to reach out to you and perhaps get involved or you know collaborate or or contribute to some code uh how can you do that my plan is to put something out there I'm not a let your I'm not an avid the email reader so I must say that very often I read 10 emails a day when I get overwhelmed and don't read the so is

nobody should take offense if I not respond I didn't know that I was signing up receiving a lot of emails but uh but I think that's that's the positive news and uh I I certainly you know I'm I am here in in Cambridge my door is always open it works much better when the email and my telephone it works better with email at least with me and until such a time in which there is somebody handling Cal but is not me I think would be the prefer mode of interacting but you know things uh may change soon thanks okay well I we've we're at the end of our show here we've went uh over the normal scheduled amount of time that

we usually take but I think we we could have went on for much longer um we'll be looking forward to seeing how algorand uh develops uh looking forward to seeing perhaps some some code uh and seeing this being implemented as part of you know some sort of blockchain network um I'm anxious to see uh you know when when actual real life testing and and at scale uh starts to emerge so thank you very much Professor for joining us today it was a fascinating discussion and we look forward to seeing where this takes us in the future thank you Sebastian it has been a lot of fun thanks and so thank you also to our listeners for tuning in we are part of let's talk Bitcoin Network you can find lots of great shows uh about Bitcoin blockchain

ethereum decentralized Technologies all kinds of good stuff over at letop bitcoin.com we release new episodes of epicenter every Monday you can download uh the audio version uh through iTunes SoundCloud or wherever you get your podcast you can also tune in on uh YouTube to watch the video episodes and uh you can also uh leave us a tip the Tipping address is in the description uh of the show and uh we're also always interested in getting reviews on iTunes it helps uh the show being discovered and uh it's always very encouraging to uh see you guys comment and uh leave reviews on iTunes so thanks so much and we look forward to being back next week

[Music] no